Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have three Computers.

PC1 and PC2 is on a private LAN, where PC1 is known to PC2 as

PC2 and PC3 is on a another LAN, where PC2 is known to PC3 as

How can I connect to PC1 from PC3 with SSH.

Is there something like:

ssh user@ -via user@
share|improve this question
up vote 17 down vote accepted
ssh -o 'ProxyCommand ssh -W %h:%p user@'

Then you can simply run ssh PC1.

Best used through an alias in ~/.ssh/config:

Host PC1
User user
ProxyCommand ssh -W %h:%p user@

For older versions of OpenSSH that don't have the -W option (I think this means ≤5.4), make sure that netcat is available on PC2 and use

Host PC1
User user
ProxyCommand ssh user@ nc %h %p
share|improve this answer
+1 Yep, and I have a similar answer stackoverflow.com/questions/1010808/1122282#1122282 with some more details. – ephemient Sep 15 '10 at 21:51
needed to install netcat – Stefan Sep 21 '10 at 10:11

Using SSH there is a clear solution:

  1. on your local machine set up your ~/.ssh/config such that it has the following:

    host WhatYouWillCallTheConnection
        hostname the.gateway.server.address.com
        user YourUsernameOnTheGateway
  2. On both the gateway and the end server you'd like to connect to, make sure that you have your local client's public keys located in the ~/.ssh/authorized_keys

  3. On the gateway machine you need to alter the ~/.ssh/authorized_keys such that at the beginning of the line that specifies your client's public key, add the forced command as follows:

    command="ssh -A user_name@ServerTheGatewaySees.ButTheClientCant.net" ...yourPublicKey....

The -A is to forward the agent if you don't like to send passwords all the time...

This way, anytime you do something like ssh WhatYouWillCallTheConnection it will run straight through the gateway and connect you to the server on the other side transparently.

share|improve this answer
Don't use ssh -A if you don't trust the administrator of the gateway machine. He can't get your private key, but as long as you're connected to the gateway with ssh -A, he can use the forwarded agent to connect to other machines as you. – Jander Oct 15 '11 at 6:44

Port Forwarding might come in handy.
From PC1:

~# ssh -fN -L 22:PC3:7777 -l <user> PC2  

7777 can be just any port (provided it is not already being used). I just like that number, plus any "ordering up" I can manage by +1 's (7778, 7779, etc, etc).

This being done, you will have a 'transparent' tunnel from PC1's local port 7777 to PC3's port 22. Just issue:

~# ssh -l <user> -p 7777 localhost  

And you should be on PC3.
You can also use -D to dynamically forward a port if you want a SOCKS proxy established.

~# ssh -D <someport> -fN -L 22:PC3:7777 -l <user> PC2  


share|improve this answer

The only solution I know for this is ssh scripting with Belier:

Belier allows opening a shell or executing a command on a remote computer through a SSH connection. The main feature of Belier is its ability to cross several intermediate computers before realizing the job.

A while ago I found this README.sshhop on the MIT Lincoln Laboratory Homepage, but I wasn't able to find any further information about that. Does somebody know more?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.